High
fava — security advisory
The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaping of error messages which contained the parameters in verbatim.
- Products
- fava
- Affected versions
- 1.10-2, 1.11-1, 1.14-1, 1.18-1, 1.20.1-1, 1.30.2+dfsg-1
- Fixed versions
- Not specified
- CVEs
- CVE-2022-2514
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 00:40 UTC · Revision 1
Source evidence
The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaping of error messages which contained the parameters in verbatim.
osv:UBUNTU-CVE-2022-2514
fava
Fixed versions: Not specified
fava
Fixed versions: Not specified
fava
Fixed versions: Not specified
fava
Fixed versions: Not specified
fava
Fixed versions: Not specified
Complete source record
{
"id": "d4c7e77afec39863d47c9765b37d3e3b49470eb8f1ad984306b6f5b1453ea94a",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-2514",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2022-2514",
"summary": "The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaping of error messages which contained the parameters in verbatim.",
"evidence": "osv:UBUNTU-CVE-2022-2514",
"products": [
{
"name": {
"value": "fava",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.10-2",
"evidence": "/affected/0/versions"
},
{
"value": "1.11-1",
"evidence": "/affected/0/versions"
},
{
"value": "1.14-1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "fava",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.18-1",
"evidence": "/affected/1/versions"
},
{
"value": "1.20.1-1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "fava",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.30.2+dfsg-1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "fava",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.30.2+dfsg-1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "fava",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.30.2+dfsg-1",
"evidence": "/affected/4/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "UBUNTU-CVE-2022-2514",
"aliases": [
"UBUNTU-CVE-2022-2514"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "fava",
"purl": "pkg:deb/ubuntu/fava?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"1.10-2",
"1.11-1",
"1.14-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-2514.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-fava",
"binary_version": "1.14-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "fava",
"purl": "pkg:deb/ubuntu/fava?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"1.18-1",
"1.20.1-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-2514.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-fava",
"binary_version": "1.20.1-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "fava",
"purl": "pkg:deb/ubuntu/fava?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"1.30.2+dfsg-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-2514.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-fava",
"binary_version": "1.30.2+dfsg-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "fava",
"purl": "pkg:deb/ubuntu/fava?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"1.30.2+dfsg-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-2514.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-fava",
"binary_version": "1.30.2+dfsg-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "fava",
"purl": "pkg:deb/ubuntu/fava?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"1.30.2+dfsg-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-2514.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-fava",
"binary_version": "1.30.2+dfsg-1"
}
]
}
}
],
"modified": "2026-10-17T12:55:57.347887346Z",
"provider": "osv",
"upstream": [
"CVE-2022-2514"
],
"references": [
"https://ubuntu.com/security/CVE-2022-2514",
"https://huntr.dev/bounties/dbf77139-4384-4dc5-9994-45a5e0747429",
"https://github.com/beancount/fava/commit/ca9e3882c7b5fbf5273ba52340b9fea6a99f3711",
"https://www.cve.org/CVERecord?id=CVE-2022-2514"
]
},
"related_cves": [
{
"value": "CVE-2022-2514",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 354356,
"published_at": "2022-07-25T14:15:00+00:00"
}